CVE-2020-24356: Local Privilege Escalation in cloudflared
Summary
CVE-2020-24356: Local Privilege Escalation in cloudflared. Affects github.com/cloudflare/cloudflared versions < 0.0.0-20200820025921-9323844ea773. Fixed in 0.0.0-20200820025921-9323844ea773. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is cloudflared, a tool developed by Cloudflare that allows users to securely connect to the Cloudflare network. It provides a secure tunnel between the user's device and the Cloudflare network, enabling access to private resources without exposing them to the public internet. This vulnerability affects versions of cloudflared prior to 2020.8.1 on Windows.
Vulnerability Detail
The vulnerability in cloudflared arises from a misconfiguration in the way it reads its configuration file on Windows. When an administrator starts cloudflared and sets it to read configuration files from a specific directory, an unprivileged user can exploit this misconfiguration to escalate privileges and execute system-level commands. The issue stems from the fact that one of the locations cloudflared reads from (C:\etc) is not a secure directory by default on Windows, as access controls are not enforced without additional measures. By creating a malformed config.yaml file, any user can write a user-controlled log file location that Windows will execute when any user logs in. This allows an attacker to execute arbitrary commands with elevated privileges.
How To Fix
Latest published version: v0.0.0-20261022222307-ee83189f8507 as of 23 Oct 2026
go get github.com/cloudflare/cloudflared@v0.0.0-20261022222307-ee83189f8507Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20200820025921-9323844ea773
This is the first release that contains the fix.
go get github.com/cloudflare/cloudflared@v0.0.0-20200820025921-9323844ea773Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can remove the ability for unprivileged users to write to the C:\etc\ directory. By enforcing access controls on this directory, the vulnerability can be mitigated. Additionally, users can monitor the directory for any changes and investigate any suspicious activity.
Conclusion
In conclusion, the vulnerability in cloudflared allows unprivileged users to escalate privileges and execute system-level commands. It is crucial for users to update their cloudflared installation to the latest version and enforce access controls on the vulnerable directory. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cloudflared →
FAQ
Cloudflared is a tool developed by Cloudflare that provides a secure tunnel between a user's device and the Cloudflare network. It allows users to access private resources without exposing them to the public internet.
The vulnerability occurs due to a misconfiguration in the way cloudflared reads its configuration file on Windows. This allows an unprivileged user to escalate privileges and execute system-level commands.
The vulnerability allows an attacker to execute arbitrary commands with elevated privileges. This can lead to unauthorized access, data breaches, and potential compromise of the affected system.
Yes, users should update their cloudflared installation to version 2020.8.1 or later to fix this vulnerability. The updated version includes the necessary security patches.
As a temporary workaround, users can enforce access controls on the C:\etc\ directory to prevent unprivileged users from writing to it. Additionally, monitoring the directory for any changes can help detect any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cloudflared.
